{"schema":"voidly-atlas-federal-record/v1","dataset":"nvd-cves","agency":"NIST","source":"NIST National Vulnerability Database","provider":"Voidly","license":"Source data is U.S. federal public domain (17 U.S.C. §105). Re-surfaced by Voidly under CC BY 4.0.","disclaimer":"This is the agency's own public-domain data, curated and made citable by Voidly. Voidly adds no independent claim — always verify against the linked canonical source.","generated_at":"2026-10-20T15:16:13.182Z","record":{"id":"CVE-2026-112898","cve_id":"CVE-2026-112898","published":"2026-10-19T22:17:10.030","last_modified":"2026-10-19T22:17:10.030","status":"Received","description":"Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":"CWE-457","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112898","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898"},"citation":{"voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112898","recommended":"CVE-2026-112898 — CVE. NIST, via Voidly Atlas — Surveillance & Digital-Rights Watch. Retrieved 2026-10-20, https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898","ris":"TY  - DATA\nTI  - CVE-2026-112898 — CVE\nAU  - Voidly\nT2  - Voidly Atlas — Surveillance & Digital-Rights Watch\nPB  - Voidly\nPY  - 2026\nUR  - https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898\nN1  - Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-112898. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0\nER  - ","apa":"Voidly. (2026). CVE-2026-112898 — CVE [NIST National Vulnerability Database]. Voidly Atlas. Retrieved 2026-10-20, from https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898","bibtex":"@misc{voidly_nvd_cves_CVE2026112898,\n  title        = {CVE-2026-112898 — CVE},\n  author       = {{Voidly}},\n  howpublished = {\\url{https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112898}},\n  note         = {Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-112898. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0},\n  urldate      = {2026-10-20},\n  year         = {2026}\n}"}}